#3771 Docs: extra-headers how-to systemd snippet puts a path in SWAMP_SERVE_EXTRA_HEADERS

content/manual/how-to/swamp-serve/use-extra-headers-with-proxies.md, Keep secrets out of shell history, shows a systemd unit with Environment=SWAMP_SERVE_EXTRA_HEADERS=Tunnel-Token: %d/tunnel-token and LoadCredential=tunnel-token:/etc/swamp/tunnel-token. In systemd, %d expands to the credentials directory path, not the credential's contents, so the header value sent is a filesystem path, not the token. Separately, swamp worker daemon enable now writes SWAMP_SERVE_EXTRA_HEADERS into the unit it generates (swamp-club#3575), so a hand edit to that unit is overwritten the next time enable runs. The snippet should be replaced with a form that actually delivers the secret (for example an EnvironmentFile readable only by root), and should say it applies to a hand-written unit, not one generated by daemon enable. Found while planning swamp-club#3599.